Mozilla Rust rocket crate competitive conditions issue vulnerability

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A contention condition issue vulnerability exists in rocket crate in versions of Mozilla Rust prior to 0.4.5, which stems from LocalRequest::clone creating multiple mutable references to the same object, which c...

Unspecified Vulnerability in Mozilla Rust (CNVD-2021-30438)

Rust is a general-purpose, compiled programming language from the Mozilla Foundation. A security vulnerability in prost crate in Mozilla Rust versions prior to 0.6.1, which stems from stack consumption via crafted messages, can be exploited by an attacker to cause a denial of service or remote co...

GitLab Github Project Import Restriction Bypass Vulnerability

GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects. A Github project import restriction bypass vulnerability exists in GitLab versions prior to 13.1. A...

NVIDIA Linux GPU Display Driver Competitive Conditions Issue Vulnerability

NVIDIA Linux GPU Display Driver is a graphics processor GPU graphics card driver from NVIDIA dedicated to the Linux platform. A security vulnerability exists in the NVIDIA Linux GPU Display Driver. An attacker could exploit this vulnerability to cause a denial of service...

Apache SkyWalking SQL Injection Vulnerability

Apache SkyWalking is an application performance monitor from the Apache Software USA Foundation primarily for environments such as microservices, cloud-native and container-based. An SQL injection vulnerability exists in the H2/MySQL/TiDB storage implementation in Apache SkyWalking versions 6.0.0...

Citrix Systems Citrix ShareFile storage zones Controller path traversal vulnerability (CNVD-2020-41790)

Citrix Systems Citrix ShareFile is a file sharing solution from Citrix Systems. storage zones Controller is one of the storage zone controllers. A path traversal vulnerability exists in Citrix Systems Citrix ShareFile storage zones Controller. An attacker can exploit this vulnerability to access...

Triangle MicroWorks DNP3 Outstation Libraries Buffer Overflow Vulnerability

Triangle MicroWorks DNP3 Outstation Libraries is a software library from Triangle MicroWorks that adds support for industry standard communication protocols to devices. A buffer has been vulnerability exists in Triangle MicroWorks DNP3 Outstation Libraries versions 3.16.00 through 3.25.01, which...

Kiali Trust Management Issues Vulnerabilities

Kiali is an open source, visual management tool for the Istio microservices architecture. A trust management issue vulnerability exists in the default configuration file in versions of Kiali prior to 1.15.1. The vulnerability stems from the fact that the file comes with a hard-coded encryption ke...

Microsoft Internet Explorer Scripting Engine Remote Code Execution Vulnerability (CNVD-2020-19968)

Microsoft Internet Explorer IE is a Web browser that comes with the Windows operating system from the American company Microsoft. A remote code execution vulnerability exists in the way the scripting engine handles memory objects in Microsoft IE 11. An attacker could exploit this vulnerability to...

Apache HTTP Server Local Elevation of Privilege Vulnerability

Apache HTTP Server is the United States Apache Apache Software Foundation of an open source web server . A local elevation of privilege vulnerability exists in Apache HTTP Server. An attacker could exploit the vulnerability to gain elevated privileges on an affected application...

LibTIFF tif_unix function null pointer reference vulnerability

LibTIFF is a library for reading and writing TIFF Tagged Image File Format files. The library contains some command line tools for working with TIFF files. A null pointer reference vulnerability exists in the LibTIFF tifunix function. An attacker could exploit this vulnerability to cause a denial...

Fortify Software Security Center (SSC) XXE Vulnerability

Micro Focus Fortify Software Security Center SSC is a software security management platform from Micro Focus UK. A XXE vulnerability exists in Fortify Software Security Center SSC that could allow a remote, unauthenticated user to read arbitrary files or conduct server-side request forgery SSRF...

GitStack Server User Add Vulnerability

GitStack is a Windows-based version control system. A security vulnerability exists in GitStack 2.3.10 and earlier versions, which stems from the program's failure to adequately filter user input. The vulnerability can be exploited to add a user to the server by sending the username and password...

3CX Phone System Directory Traversal Vulnerability

3CX Phone System is a unified communications solution that includes web conferencing, IP telephony, and cell phone clients.Management Console is one of the management console programs. A directory traversal vulnerability exists in Management Console in 3CX Phone System version 15.5.3554.1. An...

Symantec Messaging Gateway Remote Code Execution Vulnerability (CNVD-2017-28446)

Symantec Messaging Gateway is a suite of anti-spam, anti-virus, advanced content filtering and data leakage protection technologies from Symantec. A remote code execution vulnerability exists in Symantec Messaging Gateway versions prior to 10.6.3-267. A remote attacker could exploit this...

Potrace de-zero error vulnerability

potrace is a set of bitmap image processing tools developed by software developer Peter Selinger. The tool offers the ability to add smoothing effects, free scaling of images, and more. A divide-by-zero error vulnerability exists in potrace bitmap.h. A remote attacker can exploit this vulnerabili...

Multiple SQL Injection Vulnerabilities in mccart.xls Bitrix Module

Multiple SQL injection vulnerabilities exist in the mccart.xls Bitrix module. Multiple SQL injection vulnerabilities exist in the Bitrix module due to the "xlsprofile" HTTP GET parameter passed to the "/bitrix/admin/mcartxlsimport.php" script; the "/bitrix/admin/mcartxlsimport.php" script; the...

OpenStack Object Storage Information Disclosure Vulnerability

OpenStack is a cloud platform management program developed by the National Aeronautics and Space Administration in collaboration with Rackspace in the U.S. OpenStack Object Storage a.k.a. Swift is one of these programs used to storage project for storing permanent static data. A security...

Jetty Information Disclosure Vulnerability

Jetty is an open source servlet container , it is based on Java web content , such as JSP and servlet to provide a runtime environment . Jetty has an information disclosure vulnerability that allows attackers to obtain sensitive information...

TOTOLINK A702R Buffer Overflow Vulnerability

The TOTOLINK A702R is a router device manufactured by China's Gion Electronics TOTOLINK. The TOTOLINK A702R suffers from a buffer overflow vulnerability that originates from improper handling of the submit-url parameter in the /boafrm/formWlSiteSurvey file in the HTTP POST request handling...

Apache Hive Authorization Issues Vulnerability

Apache Hive is a set of data warehouse software based on Hadoop Distributed Systems Infrastructure from the Apache Apache Foundation in the United States. The software provides a data integration approach and a high-level query language to support large-scale data analysis on Hadoop. An...

WAVLINK AC3000 internet.cgi set_add_routing function's gateway parameter command injection vulnerability

WAVLINK AC3000 is a wireless router from China Ruiyin WAVLINK. A command injection vulnerability exists in the WAVLINK AC3000 M33A8.V5030.210505 version, which originates from the failure of the gateway parameter of the internet.cgi setaddrouting function to correctly filter the construct command...

WordPress Plugin DynamicTags SQL Injection Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exists in WordPress plugin DynamicTags version 1.4.0 and earlier versions,...

Siemens Tecnomatix Plant Simulation Out-of-Bounds Write Vulnerability (CNVD-2024-45993)

Siemens Tecnomatix Plant Simulation is an industrial control device from Siemens, Germany. Using the function of discrete event simulation for production volume analysis and optimization, and thus improve the manufacturing system performance. Siemens Tecnomatix Plant Simulation suffers from an...

Google Chrome Code Execution Vulnerability (CNVD-2024-48377)

Google Chrome is a web browser from Google, an American company. Google Chrome suffers from a code execution vulnerability that is caused by type confusion in V8. An attacker can exploit the vulnerability to execute arbitrary code on the system...

Siemens SIMATIC RFID Readers Improper Access Control Vulnerability

SIMATIC RF600 Readers are used for contactless identification of a variety of objects such as shipping containers, pallets, production goods, or often for recording bulk goods.SIMATIC RF1100 is an RFID-based solution for simple and versatile electronic authorization management.SIMATIC RF360R read...

NetIQ Advanced Authentication Command Execution Vulnerability

NetIQ Advanced Authentication is an application from NetIQ UK. It provides a more secure way to protect your sensitive information by moving away from usernames and passwords. A command execution vulnerability exists in NetIQ Advanced Authentication versions prior to 6.3.5.1, which can be exploit...

Cisco Identity Services Engine Cross-Site Request Forgery Vulnerability (CNVD-2024-37703)

Cisco Identity Services Engine is an environment-aware platform from the U.S. company Cisco Cisco. Cisco Identity Services Engine has a cross-site request forgery vulnerability that can be exploited by a remote attacker to construct a malicious URI, induce a request, and can perform malicious...

Mozilla Firefox for iOS Security Bypass Vulnerability (CNVD-2024-36715)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A security bypass vulnerability exists in Mozilla Firefox for iOS, which can be exploited by attackers to execute Javascript commands in the browser...

Bolt CMS Cross-Site Scripting Vulnerability (CNVD-2024-35158)

Bolt CMS is Bolt CMS open source PHP-based open source content management system . A cross-site scripting vulnerability exists in Bolt CMS version 3.7.1, which stems from the parameter textarea in the file /bolt/editcontent/showcases that causes cross-site scripting. No details of the vulnerabili...

Apache StreamPipes Security Feature Issue Vulnerability

Apache StreamPipes is a self-service industrial IoT toolkit from the Apache USA Foundation that enables non-technical users to connect, analyze and explore IIoT data streams. Apache StreamPipes suffers from a security signature issue vulnerability that stems from the presence of a cryptographical...

Mozilla Firefox Spoofing Vulnerability (CNVD-2024-29137)

Mozilla Firefox is an open source web browser from the Mozilla Foundation in the United States. A spoofing vulnerability exists in versions of Mozilla Firefox prior to 127, which can be exploited by an attacker to spoof the location URL bar...

Google Android Code Execution Vulnerability (CNVD-2024-16883)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code execution vulnerability caused by an out-of-bounds write in attpbuildvaluecmd in attprocol.cc. An attacker can exploit this vulnerability to run arbitrary code on the system...

Siemens Sinteso EN and Cerberus PRO EN Fire Protection Systems Out-of-Bounds Read Vulnerability

Cerberus PRO EN is a fire protection system consisting of fire panels, detection and management stations. It is available to Siemens partners and complies with the European standard EN 54 for fire detection and alarm systems. Sinteso EN is a fire protection system consisting of fire panels,...

Command Execution Vulnerability in Dahua EIMS System of Zhejiang Dahua Technology Co.

Zhejiang Dahua Technology Co., Ltd. is the world's leading video-centered intelligent IOT solution provider and operation service provider. A command execution vulnerability exists in the Dahua EIMS system of Zhejiang Dahua Technology Co. Ltd, which can be exploited by attackers to gain server...

Google Chrome Security Bypass Vulnerability (CNVD-2024-16936)

Google Chrome is a web browser from Google, an American company. A security bypass vulnerability exists in Google Chrome that stems from an improper implementation of the Content Security Policy module. An attacker can exploit this vulnerability to bypass security restrictions...

Adobe Acrobat and Reader Out-of-Bounds Read Vulnerability (CNVD-2024-11665)

Adobe Acrobat Reader is the United States of America Audobee Adobe, a PDF viewer. Adobe Acrobat and Reader has an out-of-bounds read vulnerability that can be exploited by an attacker to obtain sensitive information caused by an out-of-bounds read...

Apache Airflow Security Bypass Vulnerability (CNVD-2024-0101523)

Apache Airflow is the United States Apache Apache Foundation's set of open source platform for creating, managing and monitoring workflow. The platform is scalable and dynamic monitoring and other characteristics. A security bypass vulnerability exists in Apache Airflow versions prior to 2.8.0,...

Hitachi Energy RTU500 series CMU Firmware Input Validation Error Vulnerability

RTU500 is a series of industrial control components from Hitachi, Japan, mainly used in industrial control systems. An input validation error vulnerability exists in the Hitachi Energy RTU500 series CMU Firmware, which arises from a specially crafted message sent to the component that is not...

Web Server Denial of Service Vulnerability in Various Siemens Products (CNVD-2023-97269)

SIMATIC PC Station is a software component that manages SIMATIC software products and interfaces on a PC.SIMATIC S7-400 controllers are designed for discrete and continuous control in industrial environments such as manufacturing, food and beverage, and chemical industries around the world. A...

Siemens SIMATIC STEP 7 (TIA Portal) Information Disclosure Vulnerability

SIMATIC STEP 7 TIA Portal is an engineering software for configuring and programming SIMATIC controllers. An information disclosure vulnerability exists in Siemens SIMATIC STEP 7 TIA Portal, which can be exploited by an attacker to gain access...

Microweber File Upload Vulnerability (CNVD-2023-9820348)

Microweber is an online store management system that provides drag and drop functionality from the Microweber community in the United States. The system includes modules for adding products, images, and more. A file upload vulnerability exists in Microweber version v.2.0.4, which stems from the...

Adobe Premiere Pro Buffer Overflow Vulnerability (CNVD-2023-95451)

Adobe Premiere Pro is a video editing software developed by Adobe for non-linear editing. A buffer overflow vulnerability exists in Adobe Premiere Pro, which can be exploited by an attacker to overflow a buffer and execute arbitrary code on the system or cause the application to crash...

phpMyFAQ action parameter cross-site scripting vulnerability

phpMyFAQ is a multi-language, fully database-driven FAQ system. A cross-site scripting vulnerability exists in versions prior to phpMyFAQ 3.2.2, which stems from the lack of effective filtering and escaping of user-supplied data in the action parameter of admin/index.php?action=, and can be...

phpMyFAQ Information Disclosure Vulnerability

phpMyFAQ is a multi-language, fully database-driven FAQ system. An information disclosure vulnerability exists in phpMyFAQ versions prior to 3.2.2, which stems from the presence of sensitive cookies in an HTTPS session, and can be exploited by an attacker to obtain sensitive information...

Apache InLong Deserialization Vulnerability (CNVD-2023-93323)

Apache InLong is the U.S. Apache Apache Foundation's one-stop massive data integration framework. Provides automated, secure and reliable data transfer capabilities. Apache InLong has a deserialization vulnerability that originates from unsafe deserialization processing of serialized data receive...

Evolution CMS Cross-Site Scripting Vulnerability (CNVD-2023-85602)

Evolution CMS is an open source PHP-based content management system CMS. Evolution CMS suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the uid parameter, which can be exploited by an attacker to execute...

Microsoft Skype for Business elevation of privilege vulnerability (CNVD-2023-92201)

Microsoft Skype for Business Server is a secure and unified communications platform from Microsoft that provides instant messaging IM, audio and video calling, online conferencing, online status messages, and sharing capabilities. An elevation of privilege vulnerability exists in Microsoft Skype...

Siemens SIMATIC CP Device Improper Access Control Vulnerability

The SIMATIC CP 1623, CP 1626 and CP 1628 are PCI express cards for connection to industrial Ethernet. the SIMATIC CP 1604 and CP 1616 are PCI/PCI-104 cards for the connection of field devices to PROFINET industrial Ethernet. The Siemens SIMATIC CP devices suffer from an Improper Access Control...

Siemens Teamcenter Visualization and JT2Go stack buffer overflow vulnerability (CNVD-2023-69804)

Siemens Teamcenter Visualization is a software that provides teamwork capabilities for designing 2D and 3D scenarios.Siemens JT2GO is a JT file viewer. A stack buffer overflow vulnerability exists in Siemens Teamcenter Visualization and JT2Go, which can be exploited by an attacker to execute code...